Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-109431Camunda Missing Authorization in Task Sub-Resources

High 8.1

In plain English

A high-severity missing authorization in Camunda 7 from Camunda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 70.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments.

Affected products (as reported)

Vendor	Product	Versions
Camunda	Camunda 7	7.24.0 – before 7.24.147.23.0 – before 7.23.17

Weakness: CWE-862, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

CodeAnt AI Blog technical-description, exploit
Camunda Download Page product, patch
VulnCheck Advisory: Camunda Missing Authorization in Task Sub-Resources third-party-advisory